MSAB Digital Forensics Glossary
Key Terms and Definitions
Welcome to Our Digital Forensics Glossary — A resource for clear, concise definitions of key terms used in digital forensic investigations. This glossary includes terminology used in the field of smartphone investigations, mobile data extraction, and the analysis of digital evidence from mobile devices.
As mobile phones become central to cybercrime and digital investigations, it’s essential to understand critical concepts such as IMEI, mobile data acquisition, app artifacts, and SIM card analysis. You’ll also find definitions of broader digital forensics terms like hash values, metadata, and chain of custody — all explained in a straightforward, accessible format. Whether you’re a mobile forensics specialist, law enforcement officer, cybersecurity professional, or student, this glossary offers up-to-date explanations to help you navigate the rapidly evolving field of mobile forensics.
UART (Universal Asynchronous Receiver/Transmitter)
A hardware communication protocol used in forensics to access device data via serial ports, often employed in advanced mobile extractions (e.g., JTAG alternatives).
Read full termUEFI (Unified Extensible Firmware Interface)
A modern firmware standard replacing BIOS, analyzed in forensics to extract boot logs, secure boot data, or evidence of tampering in system startups.
Read full termUFDR (Universal Forensic Data Reader) in Mobile Forensics
A Universal Forensic Data Reader (UFDR) is a specialized hardware device used in mobile forensics to extract data from a wide range of mobile devices. UFDRs are designed to support multiple device interfaces, such as USB, JTAG, and ISP, and can acquire data from various storage media types, including flash memory chips and memory cards. […]
Read full termUI – User Interface
The visual or interactive layer of a forensic tool or device, designed to facilitate evidence extraction, analysis, or reporting by examiners.
Read full termUn-disable iOS Device – Mobile Device Forensics
A forensic technique removing the “iPhone is Disabled” message, typically using tools to bypass lockout timers and enable screen unlocking for data access.
Read full termUnallocated Space – Mobile Device Forensics
The area of a device’s memory outside the defined file system, available for data recovery in forensics to retrieve deleted files or fragments not yet overwritten.
Read full termUnauthorized Access
Entry into a system without permission, investigated in forensics to trace breach methods, identify perpetrators, or recover evidence of intrusion.
Read full termUnencrypted Data
Information stored without cryptographic protection, directly accessible in forensics but analyzed to determine if it was intentionally left vulnerable.
Read full termUniform Resource Locator (URL)
A web address (e.g., www.example.com), examined in forensics within browser history, logs, or malware to trace online activity or malicious redirects.
Read full termUnify
MSAB Unify, a tool designed to help examiners collaborate and complete digital forensic analysis.
Read full termUniversal Serial Bus (USB)
A common interface for connecting devices, analyzed in forensics to recover data from USB drives or detect usage via system logs (e.g., USB artifact analysis).
Read full termUnix Forensics
The investigation of Unix-based systems (e.g., Linux, macOS), focusing on file systems, logs (e.g., /var/log), and shell history to uncover evidence.
Read full termUnnamed Service – Crypto Forensics
A category of unidentified cryptocurrency clusters exhibiting service-like behavior (e.g., exchanges, mixers), analyzed to classify and trace their role in transactions.
Read full termUnspent – Crypto Forensics
Cryptocurrency value sent to a wallet but not yet spent, tracked in forensics to monitor held balances or detect dormant funds linked to illicit activity.
Read full termUntraced – Crypto Forensics
Cryptocurrency transactions or entities lacking clear attribution, investigated in forensics to uncover hidden trails or link to known actors through blockchain analysis.
Read full termUser Agent
A string identifying a browser or device to web servers, parsed in forensics from network traffic or logs to profile devices involved in online activity.
Read full termUser Datagram Protocol (UDP)
A connectionless network protocol, analyzed in forensics to investigate lightweight traffic (e.g., DNS queries) or detect UDP-based attacks like DDoS.
Read full termUser Profile
A collection of settings and data tied to a user account, examined in forensics to recover preferences, activity logs, or credentials from systems or devices.
Read full term